---
title: "Create a registration attachment"
method: POST
path: "/v1/compliance/attachments"
tags: ["attachments"]
---

# Create a registration attachment

`POST /v1/compliance/attachments`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/compliance/attachments`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Uploads a document that answers a compliance requirement, such as the proof
of address a country asks for before it approves a number. Send the file as a
`multipart/form-data` body with the bytes in a `file` part.

A requirement whose `data_type` is `document` is answered with attachment IDs
rather than a typed value. Pass the returned ID as the answer's
`attachment_id`, or in its `attachment_ids` where the requirement accepts
several. Upload before you file the submission that cites the attachment. An
unused attachment expires after seven days. After a submission cites it, the
attachment no longer expires and you can reuse it elsewhere in the workspace,
including as evidence for a 10DLC registration. Toll-free verification
evidence must be a PNG or JPEG image.

PNG, JPEG, and PDF files up to 10 MB are accepted. Uploading a file whose
contents match an existing attachment returns that attachment instead of
creating a duplicate.

## Headers

- `Idempotency-Key` string
- `X-Workspace-Id` string
- `X-Organization-Id` string

## Response `200`

An attachment with identical contents already existed and was returned unchanged.

- Attachment: A supporting document uploaded for compliance answers or SMS registrations, including number ownership evidence, 10DLC campaign evidence and toll-free verification opt-in screenshots. Reference its ID from the relevant answer or registration attachment field to submit it as evidence.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `id` string, required
  - `filename` string, required: The uploaded file's name.
  - `content_type` string, required: The file's content type, determined from its contents.
  - `size_bytes` integer, required: The file's size in bytes.
  - `description` string: A short note describing what the file shows.
  - `status` 'draft' | 'attached', required: Lifecycle of an attachment. `draft` is a file that has been uploaded but nothing has been registered or submitted with it yet, and it is discarded at its `expires_at`. `attached` means at least one registration has cited it, so it is kept permanently and can no longer be deleted.
  - `download_url` string, uri, required: Short-lived signed URL for downloading or previewing the attachment. Valid for 24 hours from when the resource was fetched; request a fresh resource to obtain a new URL after expiry. Do not cache beyond `download_url_expires_at`. Registration authorities (10DLC and toll-free carriers) retrieve evidence via a separate, longer-lived token; this URL is not that token.
  - `preview_url` string, uri: Optional signed URL for inline viewing on an isolated storage origin. Valid for one hour; fetch the attachment again to refresh it.
  - `download_url_expires_at` string, date-time, required: When `download_url` expires. Both fields are always present; the server returns an error rather than omitting them.
  - `expires_at` string, date-time, nullable, required: When this attachment is discarded if nothing is registered or submitted with it. Null once its status is `attached`.

## Other responses

- `201`: The uploaded attachment.
- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `413`: Request body or message size exceeds the allowed limit
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error
- `503`: The service is temporarily unavailable. If `Retry-After` is present, wait for that delay before retrying; otherwise, retry with exponential backoff. Reuse the same idempotency key and request when retrying a mutation.

## Changes

- **2026-10-20** `a1977645a499`: 1 info
  - endpoint added
- **2026-10-20** `6cec81ac4862`: 1 breaking
  - api path removed without deprecation
- **2026-10-20** `3e2a50466454`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/messagebird/apis/bird-api/changes/v1/compliance/attachments/post.md)

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/a1977645a499?raw)